Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T13803FE206841EC2B00DBA6D995765B2662F94341CA230789FAF487FA5BEFD6CDB37110 |
|
CONTENT
ssdeep
|
768:lefRBAPstpvPJnsUPwWTUNPJnsUBwWTU4JDcD5T3X4IGUN79F:lefRKsTPJnsUPwWTUNPJnsUBwWTUMuBd |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
d70b9542c742f53a |
|
VISUAL
aHash
|
ff2c0000000000ff |
|
VISUAL
dHash
|
e0595969a99084a4 |
|
VISUAL
wHash
|
ffbd00f8d04040ff |
|
VISUAL
colorHash
|
0e000038000 |
|
VISUAL
cropResistant
|
8080a4a484aca8d0,8009c2ecacae9029,282acb4c5ee42220,a400a02212125254,e4595d6969a19084 |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 73 techniques to evade detection by security scanners and make reverse engineering more difficult.